|
Re: Paranoid or Poirot?
Ok, so i am hoping that i am getting there slightly, i am not sure on Go To My PC, however i have been looking over the event Logs and have noticed the following:
EventData
SubjectUserSid S-1-0-0
SubjectUserName -
SubjectDomainName -
SubjectLogonId 0x0
TargetUserSid S-1-5-7
TargetUserName ANONYMOUS LOGON
TargetDomainName NT AUTHORITY
TargetLogonId 0xec3c29
LogonType 3
LogonProcessName NtLmSsp
AuthenticationPackageName NTLM
WorkstationName DUNCAN-PC
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName NTLM V1
KeyLength 128
ProcessId 0x0
ProcessName -
IpAddress 192.168.0.4
IpPort 61466
EventData
SubjectUserSid S-1-0-0
SubjectUserName -
SubjectDomainName -
SubjectLogonId 0x0
TargetUserSid S-1-5-7
TargetUserName ANONYMOUS LOGON
TargetDomainName NT AUTHORITY
TargetLogonId 0x8a922e
LogonType 3
LogonProcessName NtLmSsp
AuthenticationPackageName NTLM
WorkstationName YOUR-A9279112E3
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName NTLM V1
KeyLength 0
ProcessId 0x0
ProcessName -
IpAddress 192.168.0.2
IpPort 4924
Now if I remember correctly the point at which I first mentioned seeing the Duncan-PC connection to my friends coincides with the fact that from then on all Logon Type 3 events, that show a workstation name, swap to YOUR-A9279112E3. Duncans pc was the hub for our network, does any of this make any sense? |